June 2007 - Freeradius-Users - lists.freeradius.org

Spliting National & International
by Liam Farr 27 Jun '07

27 Jun '07

Hi, Is there an easy way to separate accounting for national and international traffic with freeradius? (National traffic is charged at a lower rate per GB than international). Any suggestions would be appreciated. Cheers Liam

3 8

RE: Banning users in a nice way...
by Josh Howlett 27 Jun '07

27 Jun '07

> Has anyone got any ideas ? > > I'm assuming theres no way to do it.. Not that I can think of. You shouldn't be able to coax a supplicant onto a network by munging authentication (this is a *good* thing). josh.

1 0

FreeRadius Certificate Problem
by Dead6re 27 Jun '07

27 Jun '07

Hello all, Iam havea huge problem using CA.all to generate the certificates needed for FreeRadius. I am currently using Fedora and my OpenSSL version is: 0.9.8b and has recently been updated. Using configuration from /usr/local/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 17811:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('./demoCA/serial','r') 17811:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: + openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-srv.p12 -clcerts -passin pass:<my pass> -passout pass:<my pass> No certificate matches private key + openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin pass:<my pass> -passout pass:<my pass> 17813:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: + openssl x509 -inform PEM -outform DER -in cert-srv.pem -out cert-srv.der unable to load certificate 17814:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE How do I fix this error? Thanks, Dead6re -- View this message in context: http://www.nabble.com/FreeRadius-Certificate-Problem-tf3981133.html#a113018… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

radclient with -S option
by Diana Robert 27 Jun '07

27 Jun '07

hi, if we are going to use -S option in radclient, wat should be the format of that shared secret file. thanks --------------------------------- Once upon a time there was 1 GB storage on Yahoo! Mail. Click here for happy ending!

1 0

2.0.0-pre sqlippool
by Hugh Messenger 27 Jun '07

27 Jun '07

I'm slowly getting there with my 2.0.0 install. Couple of sqlippool questions: 1) The sqlippool.conf file has this at the end: ## Uncomment the appropriate config file for your SQL dialect # $INCLUDE ${confdir}/sql/mysql-dialup.conf $INCLUDE ${confdir}/sql/postgresql-ippool-dialup.conf I'm pretty sure the mysql-dialup.conf should be mysql-ippool-dialup.conf, so MySQL users would have: $INCLUDE ${confdir}/sql/mysql-ippool-dialup.conf # $INCLUDE ${confdir}/sql/postgresql-ippool-dialup.conf 2) Where can I find the sqlippool schema in 2.0.0? I can't even find it in my 1.1.6 install. I remember having to search for it, but I've completely blanked on where I found it. Obviously I could export the schema from the 1.1.6 mysql db, but I'd like to be sure there haven't been any schema changes between 1.1.6 and 2.0.0. -- hugh

2 1

Re: 2.0.0 documentation for radiusd.conf
by Hugh Messenger 27 Jun '07

27 Jun '07

Alan Dekok <aland(a)deployingradius.com> said: > Hugh Messenger wrote: > > Any luck fixing this stuff: > > > > DEFAULT Called-Station-Id =~ "^([A-z0-9]+_[0-9]+)$", Pool-Name := `%{0}` > > Framed-IP-Netmask = 255.255.0.0, > > Fall-Through = 1 > > > > ... in either users or hints? > > Don't use "users" or "hints". Use the new unlanguage. [snip] > authorize { > ... > if (Called-Station-Id =~ /^([A-z0-9]+_[0-9]+)$/) { > update config { > Pool-Name := "%{0}" > } > update reply { > Framed-IP-Netmask = 255.255.0.0 > } > } > .... > } > > Much easier to understand, I think. And better yet, it works. :0 One small fix though, it needs the "%{}" around Called-Station-Id ... If ("%{Called-Station-Id}" =~ /^([A-z0-9]+_[0-9]+)$/) { > Alan DeKok. I like this new unlang. -- hugh

2 1

High load after restart
by Brian Walters 27 Jun '07

27 Jun '07

Has anyone noticed high processor loads after restarting freeradius 1.1.3 or 1.1.6? I've noticed this on Debian as well as CentOS 4.5. When I say high loads I'm talking about something like this: load average: 242.56, 121.83, 52.65 This is on Dell dual processor box with 2G of ram. I can send configs and such. I've also noticed these entries in the logs Tue Jun 26 11:36:14 2007 : Info: The maximum number of threads (254) are active, cannot spawn new thread to handle request Tue Jun 26 11:36:14 2007 : Info: The maximum number of threads (254) are active, cannot spawn new thread to handle request Tue Jun 26 11:36:14 2007 : Info: The maximum number of threads (254) are active, cannot spawn new thread to handle request -- Brian

2 1

kill radiusd
by suganthi velusamy 26 Jun '07

26 Jun '07

Hi... how to kill radiusd? Thanks... --------------------------------- Download prohibited? No problem. CHAT from any browser, without download.

2 1

re: users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

hi now the authentication type is local with the message user supplied user-password does not match local user-password see attached file thanks -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

How to pass attributes from EAP-TTLS outer to inner?
by Jason Murray 26 Jun '07

26 Jun '07

I have a situation where I need to pass the "Called-Station-Id" from the outer "anonymous" EAP Authentication-Request to the inner-authentication request. Is this possible? The problem is all my inner authentication requests look like this: Tue Jun 26 10:55:03 2007 User-Name = "me@realm" User-Password = "somepass" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Everything looks like it is coming from localhost. I need the Called-Station-Id in order to limit who has access to certain wireless SSIDs Is there a better way to authorize a user on a specific SSID using EAP-TTLS, since all the valuable information is in the outer anonymous authentication request? Thanks in advance, --Jason

2 2